fix(nix): use pnpm.fetchDeps derivation and add flake lock

docs/plans/state.json

@@ -60,7 +60,7 @@
       "status": "completed",
       "date": "2026-02-16",
       "updated": "2026-02-16",
-      "summary": "Added a Nix flake/package that builds dist/ (including dist/gateway/ui adjacency) and an optional NixOS module (services.flynn) for systemd deployment.",
+      "summary": "Added a Nix flake/package that builds dist/ (including dist/gateway/ui adjacency) and an optional NixOS module (services.flynn) for systemd deployment. Follow-up fix switched package build from unavailable buildPnpmPackage to pnpm.fetchDeps + stdenv.mkDerivation and added flake.lock.",
       "files_created": [
         "flake.nix",
         "nix/package.nix",
@@ -68,9 +68,11 @@
         "docs/deployment/NIX.md"
       ],
       "files_modified": [
-        "docs/deployment/PRODUCTION.md"
+        "docs/deployment/PRODUCTION.md",
+        "flake.lock",
+        "nix/package.nix"
       ],
-      "test_status": "Not run (Nix build requires pnpmDepsHash update); pnpm test suite unaffected"
+      "test_status": "nix build now evaluates; still requires real pnpm.fetchDeps hash from first build"
     },
 
     "deployment-targets-paas": {

flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1771008912,
+        "narHash": "sha256-gf2AmWVTs8lEq7z/3ZAsgnZDhWIckkb+ZnAo5RzSxJg=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a82ccc39b39b621151d6732718e3e250109076fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/package.nix

@@ -2,13 +2,13 @@
 let
   lib = pkgs.lib;
 in
-pkgs.buildPnpmPackage rec {
+pkgs.stdenv.mkDerivation rec {
   pname = "flynn";
   version = "0.1.0";
 
   # Keep the source small and deterministic for Nix builds.
   src = lib.cleanSourceWith {
-    src = ./.;
+    src = ../.;
     filter =
       path: type:
       let
@@ -23,15 +23,21 @@ pkgs.buildPnpmPackage rec {
       );
   };
 
-  pnpmLock = ./pnpm-lock.yaml;
+  pnpmDeps = pkgs.pnpm.fetchDeps {
+    inherit pname version src;
 
     # NOTE: Update this hash after the first `nix build` by copying the
   # "got: sha256-..." value from the error message.
-  pnpmDepsHash = lib.fakeHash;
+    hash = lib.fakeHash;
+  };
 
   nativeBuildInputs = [
+    pkgs.nodejs_22
+    pkgs.pnpm.configHook
     pkgs.makeWrapper
     pkgs.python3
+    pkgs.gnumake
+    pkgs.gcc
     pkgs.pkg-config
   ];
 
@@ -65,4 +71,3 @@ pkgs.buildPnpmPackage rec {
     mainProgram = "flynn";
   };
 }
-